When a user is renamed, their user scripts too, but on the old title a redirect is set to the new (Eg: Old title and New title). And recently a user found that the script doesn't work for anyone who had installed the script before rename.
As a lot of users get renamed every day, it is not possible to fix these plus they require an interface admin.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Allow loading JS/CSS pages orphaned due to user renames | mediawiki/core | master | +38 -15 |
Can't reproduce, the redirect works fine with my Firefox 78.6.1 ESR on Debian buster. Which browser are you using?
I am using Chrome Version 87.0.4280.141. Tried firefox 84.0.2 and I can reproduce it.
{F34006552}
Ah, that explains it (and why I couldn't reproduce by just copying and pasting the code to my browsers console). Tagging security for awareness.
I think URL breakage is intended, see T207603: CVE-2019-12471: Loading JS from user space where the username is not a registered account is dangerous and should be banned.
Any proposals what else to do? "Block" the previous username forever?
Currently old username is added to antispoof so only an account creator or admin can register them, but if that's not enough, I support it blocking forever (only when js pages are involved and there's a redirect) instead of breaking all these scripts.
We could probably allow loading orphaned javascript pages as long as they are redirects, those are already protected against editing.
So, if a Toolforge account maintaining a script is adopted, the script is moved, BAM – all script users no longer can load it, until an interface-admin runs a bot task to replace the user name in the scripts loading it. (This is what just happened in ruwiki.)
Change 986666 had a related patch set uploaded (by SD0001; author: SD0001):
[mediawiki/core@master] Allow loading JS/CSS pages orphaned due to user renames
This continuously causes issues with user scripts after any rename, I am asking someone from Security-Team to take time to review the patch provided.
@mmartorana will have a look. As long as there aren't any issues with username usurpation, etc, the patch is probably fine.
Hey @stjn - I voted +1 on the gerrit change, as the proposed change appears to be secure in my opinion.
This came up today at https://en.wikipedia.org/wiki/User_talk:Anne_drew/SetupAutoArchive#Page_move. It's a bit unintuitive for redirects generated by an official MediaWiki extension to not work. Hopefully the patch in this ticket can continue moving forward.
@mmartorana it looks like someone needs to re-vote on code review now that CI is passing